PT-2026-51905 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-53011

Mitre

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: fix use-after-free in advance sched() on schedule switch

In advance sched(), when should change schedules() returns true, switch schedules() is called to promote the admin schedule to oper. switch schedules() queues the old oper schedule for RCU freeing via call rcu(), but 'next' still points into an entry of the old oper schedule. The subsequent 'next->end time = end time' and rcu assign pointer(q->current entry, next) are use-after-free.

Fix this by selecting 'next' from the new oper schedule immediately after switch schedules(), and using its pre-calculated end time. setup first end time() sets the first entry's end time to base time + interval when the schedule is installed, so the value is already correct.

The deleted 'end time = sched base time(admin)' assignment was also harmful independently: it would overwrite the new first entry's pre-calculated end time with just base time.

Related Identifiers

CVE-2026-53011

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53011 · Security Note
• https://git.kernel.org/stable/c/0e62171df8ed4804d00db088f17eed06468233fa · Note
• https://git.kernel.org/stable/c/7256996e1ef553716817f3bfd077c2f3b48b582f · Note
• https://git.kernel.org/stable/c/1bd286fa3e21200133478ed523cc6a2788baf38a · Note
• https://git.kernel.org/stable/c/105425b1969c5affe532713cfac1c0b320d7ac2b · Note
• https://git.kernel.org/stable/c/b73235da5dde77ed1264f9767b62c28c9d71fd78 · Note
• https://git.kernel.org/stable/c/3471874578160a28c171a607fa069f24062634b8 · Note
• https://git.kernel.org/stable/c/eee072fe16c646190d33ae69c9983d8de1562bf8 · Note
• https://git.kernel.org/stable/c/a8fc396519ef4f081bc545e88f61241728bb78d7 · Note